netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-53349
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-01 14:16:43 UTC
Updated2026-07-01 14:16:43 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops.

Risk And Classification

EPSS: 0.001610000 probability, percentile 0.055960000 (date 2026-07-04)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 fbfde85308b99938a6092c48753214d190ece48d git Not specified
CNA Linux Linux affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 29d8cc44bbdf7b83a1929912214afe6643c1b4f1 git Not specified
CNA Linux Linux affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d git Not specified
CNA Linux Linux affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 9d017671dcfcec23321fb7962dea624f9e71ddb1 git Not specified
CNA Linux Linux affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 bf8c0b5dd203be94c2ad50e264cec19267c6bd39 git Not specified
CNA Linux Linux affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 git Not specified
CNA Linux Linux affected 2.6.20 Not specified
CNA Linux Linux unaffected 2.6.20 semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.94 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.36 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.13 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9d017671dcfcec23321fb7962dea624f9e71ddb1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/29d8cc44bbdf7b83a1929912214afe6643c1b4f1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fbfde85308b99938a6092c48753214d190ece48d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bf8c0b5dd203be94c2ad50e264cec19267c6bd39 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report